CVE-2026-27785 is a vulnerability in specific firmware versions of the Milesight MS-Cxx63-PD AIOT camera where hard-coded credentials are present. This weakness (CWE-798) can allow unauthorized access if an attacker can leverage these embedded credentials. The CVSS 4.0 base score is 7.7, reflecting a high severity due to the potential impact on confidentiality, integrity, and availability. The vulnerability is not related to cloud services and no official remediation level or patch has been documented in the available data.

The presence of hard-coded credentials in the affected firmware versions can lead to unauthorized access to the device, potentially compromising the confidentiality, integrity, and availability of the camera and its data. This could allow attackers to bypass authentication controls without user interaction or privileges. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider mitigating risk by restricting network access to the affected devices, disabling unnecessary services, or replacing devices with updated firmware once available. Monitor official Milesight communications for updates on patches or mitigations.